The card for Leaving a legacy SOAR
A team that owns XSOAR, Splunk SOAR, Swimlane, Siemplify or another older SOAR, with hundreds of playbooks, and has decided to move or has been told to.
Migration carries 30, since the row asks for named formats, converters, what does not port and parallel-run guidance. Integrations carry 14, because a connector missing in the target stops a playbook. Authoring carries 12, since most of the work is a rebuild. On these weights D3 Security is first, on a migration program that names six sources and lists what does not port, all of it vendor claim from a seller of the destination. Cyware is second at 6.89, carried by authoring and integrations: its product page lists import and export of playbooks and names no format or source platform, which scores 5.0. Read the matrix before you trust any of it: no cell in the portability matrix rests on a technical importer document, and 64 of 637 applicable cells carry a path, all vendor statements. Mate Security claims translation without naming a source or format, so it scores as no documented path and sits tenth on these weights, below Splunk SOAR, Swimlane, Cortex XSOAR and Google SecOps, whose pages name a file format or a source platform. The switching guides cover seven sources one by one.
The covered platforms, in this order
- 1 D3 Security 7.13 Opens a band.
- 2 Cyware 6.89 Band with D3 Security: within 0.25 of the top.
- 3 Torq 6.65 Opens a band.
- 4 Splunk SOAR (Cisco) 6.54 In the same band as the row above.
- 5 Microsoft Sentinel 6.44 In the same band as the row above.
- 6 Tines 6.36 Opens a band.
- 7 Swimlane (Turbine) 6.19 In the same band as the row above.
- 8 Palo Alto Cortex XSOAR 6.16 In the same band as the row above.
- 9 Google Security Operations 6.06 Opens a band.
- 10 Mate Security 6.03 In the same band as the row above.
- 11 BlinkOps 5.88 In the same band as the row above.
- 12 ServiceNow Security Operations 4.56 Opens a band.
The weights used
| Row | Weight on this card | Weight on the main card |
|---|---|---|
| Playbook authoring model | 12.0 | 14 |
| Integration count and depth documented | 14.0 | 14 |
| Case management and collaboration | 6.0 | 8 |
| Approvals and human-in-the-loop controls | 10.0 | 12 |
| Agentic or AI features that are documented | 8.0 | 12 |
| Hosting and data residency options | 4.0 | 8 |
| Pricing model and transparency | 6.0 | 8 |
| Migration tooling and import or export formats | 30.0 | 14 |
| Ownership stability | 10.0 | 10 |
Totals are computed from the same nine scores as everywhere on the site, reweighted. Totals within 0.25 are a band, not a ladder. How the scoring works.